Update a CoreWeave CKS cluster

Update cluster

curl --request PATCH \
  --url https://api.coreweave.com/v1beta1/cks/clusters/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "id": "<string>",
  "version": "<string>",
  "updateMask": "<string>",
  "public": true,
  "auditPolicy": "<string>",
  "network": {
    "internalLbCidrNames": [
      "<string>"
    ]
  },
  "disableOidcInfoPublication": true,
  "kubelet": {},
  "additionalServerSans": [
    "<string>"
  ],
  "tailscale": {
    "clientId": "<string>"
  }
}
'

import requests

url = "https://api.coreweave.com/v1beta1/cks/clusters/{id}"

payload = {
    "id": "<string>",
    "version": "<string>",
    "updateMask": "<string>",
    "public": True,
    "auditPolicy": "<string>",
    "network": { "internalLbCidrNames": ["<string>"] },
    "disableOidcInfoPublication": True,
    "kubelet": {},
    "additionalServerSans": ["<string>"],
    "tailscale": { "clientId": "<string>" }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    id: '<string>',
    version: '<string>',
    updateMask: '<string>',
    public: true,
    auditPolicy: '<string>',
    network: {internalLbCidrNames: ['<string>']},
    disableOidcInfoPublication: true,
    kubelet: {},
    additionalServerSans: ['<string>'],
    tailscale: {clientId: '<string>'}
  })
};

fetch('https://api.coreweave.com/v1beta1/cks/clusters/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.coreweave.com/v1beta1/cks/clusters/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'id' => '<string>',
    'version' => '<string>',
    'updateMask' => '<string>',
    'public' => true,
    'auditPolicy' => '<string>',
    'network' => [
        'internalLbCidrNames' => [
                '<string>'
        ]
    ],
    'disableOidcInfoPublication' => true,
    'kubelet' => [
        
    ],
    'additionalServerSans' => [
        '<string>'
    ],
    'tailscale' => [
        'clientId' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.coreweave.com/v1beta1/cks/clusters/{id}"

	payload := strings.NewReader("{\n  \"id\": \"<string>\",\n  \"version\": \"<string>\",\n  \"updateMask\": \"<string>\",\n  \"public\": true,\n  \"auditPolicy\": \"<string>\",\n  \"network\": {\n    \"internalLbCidrNames\": [\n      \"<string>\"\n    ]\n  },\n  \"disableOidcInfoPublication\": true,\n  \"kubelet\": {},\n  \"additionalServerSans\": [\n    \"<string>\"\n  ],\n  \"tailscale\": {\n    \"clientId\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.coreweave.com/v1beta1/cks/clusters/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"id\": \"<string>\",\n  \"version\": \"<string>\",\n  \"updateMask\": \"<string>\",\n  \"public\": true,\n  \"auditPolicy\": \"<string>\",\n  \"network\": {\n    \"internalLbCidrNames\": [\n      \"<string>\"\n    ]\n  },\n  \"disableOidcInfoPublication\": true,\n  \"kubelet\": {},\n  \"additionalServerSans\": [\n    \"<string>\"\n  ],\n  \"tailscale\": {\n    \"clientId\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.coreweave.com/v1beta1/cks/clusters/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"id\": \"<string>\",\n  \"version\": \"<string>\",\n  \"updateMask\": \"<string>\",\n  \"public\": true,\n  \"auditPolicy\": \"<string>\",\n  \"network\": {\n    \"internalLbCidrNames\": [\n      \"<string>\"\n    ]\n  },\n  \"disableOidcInfoPublication\": true,\n  \"kubelet\": {},\n  \"additionalServerSans\": [\n    \"<string>\"\n  ],\n  \"tailscale\": {\n    \"clientId\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "cluster": {
    "name": "<string>",
    "zone": "<string>",
    "vpcId": "<string>",
    "version": "<string>",
    "network": {
      "podCidrName": "<string>",
      "serviceCidrName": "<string>",
      "internalLbCidrNames": [
        "<string>"
      ],
      "serviceNodePortRange": {
        "start": 123,
        "end": 123
      }
    },
    "id": "<string>",
    "public": true,
    "oidc": {
      "issuerUrl": "<string>",
      "clientId": "<string>",
      "usernameClaim": "<string>",
      "usernamePrefix": "<string>",
      "groupsClaim": "<string>",
      "groupsPrefix": "<string>",
      "ca": "<string>",
      "requiredClaim": "<string>",
      "adminGroupBinding": "<string>",
      "signingAlgorithms": [
        "<string>"
      ]
    },
    "authzWebhook": {
      "server": "<string>",
      "ca": "<string>"
    },
    "authnWebhook": {
      "server": "<string>",
      "ca": "<string>"
    },
    "auditPolicy": "<string>",
    "apiServerEndpoint": "<string>",
    "createdAt": "2023-11-07T05:31:56Z",
    "updatedAt": "2023-11-07T05:31:56Z",
    "isUpgradeable": true,
    "disableOidcInfoPublication": true,
    "kubelet": {},
    "additionalServerSans": [
      "<string>"
    ],
    "tailscale": {
      "clientId": "<string>",
      "tailnetDomain": "<string>"
    },
    "status": "<string>"
  }
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

PATCH

v1beta1

cks

clusters

{id}

Update cluster

curl --request PATCH \
  --url https://api.coreweave.com/v1beta1/cks/clusters/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "id": "<string>",
  "version": "<string>",
  "updateMask": "<string>",
  "public": true,
  "auditPolicy": "<string>",
  "network": {
    "internalLbCidrNames": [
      "<string>"
    ]
  },
  "disableOidcInfoPublication": true,
  "kubelet": {},
  "additionalServerSans": [
    "<string>"
  ],
  "tailscale": {
    "clientId": "<string>"
  }
}
'

import requests

url = "https://api.coreweave.com/v1beta1/cks/clusters/{id}"

payload = {
    "id": "<string>",
    "version": "<string>",
    "updateMask": "<string>",
    "public": True,
    "auditPolicy": "<string>",
    "network": { "internalLbCidrNames": ["<string>"] },
    "disableOidcInfoPublication": True,
    "kubelet": {},
    "additionalServerSans": ["<string>"],
    "tailscale": { "clientId": "<string>" }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    id: '<string>',
    version: '<string>',
    updateMask: '<string>',
    public: true,
    auditPolicy: '<string>',
    network: {internalLbCidrNames: ['<string>']},
    disableOidcInfoPublication: true,
    kubelet: {},
    additionalServerSans: ['<string>'],
    tailscale: {clientId: '<string>'}
  })
};

fetch('https://api.coreweave.com/v1beta1/cks/clusters/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.coreweave.com/v1beta1/cks/clusters/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'id' => '<string>',
    'version' => '<string>',
    'updateMask' => '<string>',
    'public' => true,
    'auditPolicy' => '<string>',
    'network' => [
        'internalLbCidrNames' => [
                '<string>'
        ]
    ],
    'disableOidcInfoPublication' => true,
    'kubelet' => [
        
    ],
    'additionalServerSans' => [
        '<string>'
    ],
    'tailscale' => [
        'clientId' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.coreweave.com/v1beta1/cks/clusters/{id}"

	payload := strings.NewReader("{\n  \"id\": \"<string>\",\n  \"version\": \"<string>\",\n  \"updateMask\": \"<string>\",\n  \"public\": true,\n  \"auditPolicy\": \"<string>\",\n  \"network\": {\n    \"internalLbCidrNames\": [\n      \"<string>\"\n    ]\n  },\n  \"disableOidcInfoPublication\": true,\n  \"kubelet\": {},\n  \"additionalServerSans\": [\n    \"<string>\"\n  ],\n  \"tailscale\": {\n    \"clientId\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.coreweave.com/v1beta1/cks/clusters/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"id\": \"<string>\",\n  \"version\": \"<string>\",\n  \"updateMask\": \"<string>\",\n  \"public\": true,\n  \"auditPolicy\": \"<string>\",\n  \"network\": {\n    \"internalLbCidrNames\": [\n      \"<string>\"\n    ]\n  },\n  \"disableOidcInfoPublication\": true,\n  \"kubelet\": {},\n  \"additionalServerSans\": [\n    \"<string>\"\n  ],\n  \"tailscale\": {\n    \"clientId\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.coreweave.com/v1beta1/cks/clusters/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"id\": \"<string>\",\n  \"version\": \"<string>\",\n  \"updateMask\": \"<string>\",\n  \"public\": true,\n  \"auditPolicy\": \"<string>\",\n  \"network\": {\n    \"internalLbCidrNames\": [\n      \"<string>\"\n    ]\n  },\n  \"disableOidcInfoPublication\": true,\n  \"kubelet\": {},\n  \"additionalServerSans\": [\n    \"<string>\"\n  ],\n  \"tailscale\": {\n    \"clientId\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "cluster": {
    "name": "<string>",
    "zone": "<string>",
    "vpcId": "<string>",
    "version": "<string>",
    "network": {
      "podCidrName": "<string>",
      "serviceCidrName": "<string>",
      "internalLbCidrNames": [
        "<string>"
      ],
      "serviceNodePortRange": {
        "start": 123,
        "end": 123
      }
    },
    "id": "<string>",
    "public": true,
    "oidc": {
      "issuerUrl": "<string>",
      "clientId": "<string>",
      "usernameClaim": "<string>",
      "usernamePrefix": "<string>",
      "groupsClaim": "<string>",
      "groupsPrefix": "<string>",
      "ca": "<string>",
      "requiredClaim": "<string>",
      "adminGroupBinding": "<string>",
      "signingAlgorithms": [
        "<string>"
      ]
    },
    "authzWebhook": {
      "server": "<string>",
      "ca": "<string>"
    },
    "authnWebhook": {
      "server": "<string>",
      "ca": "<string>"
    },
    "auditPolicy": "<string>",
    "apiServerEndpoint": "<string>",
    "createdAt": "2023-11-07T05:31:56Z",
    "updatedAt": "2023-11-07T05:31:56Z",
    "isUpgradeable": true,
    "disableOidcInfoPublication": true,
    "kubelet": {},
    "additionalServerSans": [
      "<string>"
    ],
    "tailscale": {
      "clientId": "<string>",
      "tailnetDomain": "<string>"
    },
    "status": "<string>"
  }
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

Authorizations

Authorization

string

header

default:Bearer {API_ACCESS_TOKEN}

required

CoreWeave API access token sent as a bearer token.

Path Parameters

string

required

The ID of the cluster to update.

Body

application/json

string

required

The unique identifier for the cluster to update.

version

string

required

The version of Kubernetes to run on the cluster, in minor version format (for example, v1.32). Patch versions are applied automatically by CKS as they are released.

updateMask

string<field-mask>

A field mask specifying which fields to update. When omitted, all fields in the request body are updated. See the PATCH operation documentation for the preliminary list of valid paths and Google AIP-157 for field-mask syntax.

public

boolean

Whether the cluster's api-server is publicly accessible from the Internet.

oidc

object

OpenID Connect (OIDC) configuration for authentication to the api-server.

Show child attributes

authzWebhook

object

Authorization webhook configuration for the cluster.

Show child attributes

authnWebhook

object

Authentication webhook configuration for the cluster.

Show child attributes

auditPolicy

string

Audit policy for the cluster. Must be provided as a base64-encoded JSON or YAML string.

network

object

Mutable subset of the Kubernetes overlay network configuration. Only internalLbCidrNames and serviceNodePortRange may be updated.

Show child attributes

disableOidcInfoPublication

boolean

When true, suppresses publication of the /.well-known/openid-configuration and /openid/v1/jwks endpoints to oidc.cks.coreweave.com/id/[CLUSTER-ID], so the cluster cannot be used as a public OIDC provider. Publishing these endpoints exposes the cluster's OIDC configuration and JWKS to the public Internet.

kubelet

object

A JSON object of selective overrides applied to every cluster Node's kubelet configuration. A Node reboot is required for changes to take effect. Unknown options are stored but ignored. See the Kubernetes kubelet configuration reference for supported options.

additionalServerSans

string[]

Up to 10 additional Subject Alternative Names to include on the Kubernetes API server certificate. Each entry must be unique.

tailscale

object

Tailscale configuration for the cluster.

Show child attributes

Response

cluster

object

The cluster.

Show child attributes

Last modified on August 13, 2026